Hardening guidelines for StorageGRID networks
Suggest changes
PDFs
The StorageGRID system supports up to three network interfaces per grid node, allowing you to configure the networking for each individual grid node to match your security and access requirements.
Guidelines for the Grid Network
You must configure a Grid Network for all internal StorageGRID traffic. All grid nodes are on the Grid Network, and they must be able to talk to all other nodes.
When configuring the Grid Network, follow these guidelines:
-
Ensure that the network is secured from untrusted clients, such as those on the open internet.
-
When possible, use the Grid Network exclusively for internal traffic. Both the Admin Network and the Client Network have additional firewall restrictions that block external traffic to internal services. Using the Grid Network for external client traffic is supported, but this use offers fewer layers of protection.
-
If the StorageGRID deployment spans multiple data centers, use a virtual private network (VPN) or equivalent on the Grid Network to provide additional protection for internal traffic.
-
Some maintenance procedures require secure shell (SSH) access on port 22 between the primary Admin Node and all other grid nodes. Use an external firewall to restrict SSH access to trusted clients.
Guidelines for the Admin Network
The Admin Network is typically used for administrative tasks (trusted employees using the Grid Manager or SSH) and for communicating with other trusted services such as LDAP, DNS, NTP, or KMS (or KMIP server). However, StorageGRID does not enforce this usage internally.
If you are using the Admin Network, follow these guidelines:
-
Block all internal traffic ports on the Admin Network. See the list of internal ports in the installation guide for your platform.
-
If untrusted clients can access the Admin Network, block access to StorageGRID on the Admin Network with an external firewall.
Guidelines for the Client Network
The Client Network is typically used for tenants and for communicating with external services, such as the CloudMirror replication service or another platform service. However, StorageGRID does not enforce this usage internally.
If you are using the Client Network, follow these guidelines:
-
Block all internal traffic ports on the Client Network. See the list of internal ports in the installation guide for your platform.
-
Accept inbound client traffic only on explicitly configured endpoints. See the information about managing untrusted Client Networks in the instructions for administering StorageGRID.